Securing Your Digital Fortress

/**
 * XSS Payload Detection Tool
 * Scans input for common XSS attack patterns
 */

class XSSDetector {
  constructor() {
    this.patterns = [
      /)<[^<]*)*<\/script>/gi,
      /javascript\s*:/gi,
      /onerror\s*=/gi,
      /onload\s*=/gi,
      /onclick\s*=/gi,
      /onmouseover\s*=/gi,
      /eval\s*\(/gi,
      /expression\s*\(/gi,
      /document\.cookie/gi,
      /document\.location/gi,
      /alert\s*\(/gi,
      /prompt\s*\(/gi,
      /confirm\s*\(/gi,
      /iframe/gi,
      /data:text\/html/gi,
      /base64/gi
    ];

    this.riskLevels = {
      HIGH: 'High Risk',
      MEDIUM: 'Medium Risk',
      LOW: 'Low Risk',
      SAFE: 'No Detected Risk'
    };
  }

  scan(input) {
    if (!input) return { risk: this.riskLevels.SAFE, matches: [] };

    const matches = [];
    let highestRisk = this.riskLevels.SAFE;

    // Check each pattern
    this.patterns.forEach((pattern, index) => {
      if (pattern.test(input)) {
        let risk;

        // Determine risk level based on pattern type
        if (index < 5) {
          risk = this.riskLevels.HIGH;
        } else if (index < 10) {
          risk = this.riskLevels.MEDIUM;
        } else {
          risk = this.riskLevels.LOW;
        }

        matches.push({
          pattern: pattern.toString(),
          risk
        });

        // Update highest risk level
        if (risk === this.riskLevels.HIGH && highestRisk !== this.riskLevels.HIGH) {
          highestRisk = this.riskLevels.HIGH;
        } else if (risk === this.riskLevels.MEDIUM &&
                  highestRisk !== this.riskLevels.HIGH &&
                  highestRisk !== this.riskLevels.MEDIUM) {
          highestRisk = this.riskLevels.MEDIUM;
        } else if (risk === this.riskLevels.LOW && highestRisk === this.riskLevels.SAFE) {
          highestRisk = this.riskLevels.LOW;
        }
      }
    });

    return {
      risk: highestRisk,
      matches
    };
  }

  sanitize(input) {
    if (!input) return '';

    // Basic sanitization (in real-world, use a proper library)
    return input
      .replace(//g, '>')
      .replace(/"/g, '"')
      .replace(/'/g, ''')
      .replace(/\//g, '/');
  }
}

// Demo usage
const detector = new XSSDetector();
const sample = '';
console.log('Scanning:', sample);
const result = detector.scan(sample);
console.log('Result:', result);
console.log('Sanitized:', detector.sanitize(sample));

/**
 * End-to-End Encryption Demo Tool
 * Uses Web Crypto API for client-side encryption
 */

class SecureMessenger {
  constructor() {
    this.keyPair = null;
    this.publicKey = null;
    this.privateKey = null;
  }

  // Generate RSA key pair
  async generateKeyPair() {
    try {
      this.keyPair = await window.crypto.subtle.generateKey(
        {
          name: "RSA-OAEP",
          modulusLength: 2048,
          publicExponent: new Uint8Array([1, 0, 1]),
          hash: "SHA-256",
        },
        true,
        ["encrypt", "decrypt"]
      );

      this.publicKey = this.keyPair.publicKey;
      this.privateKey = this.keyPair.privateKey;

      // Export public key for sharing
      const exportedPublicKey = await window.crypto.subtle.exportKey(
        "spki",
        this.publicKey
      );

      // Convert to base64 for easier sharing
      const exportedPublicKeyBase64 = btoa(
        String.fromCharCode(...new Uint8Array(exportedPublicKey))
      );

      console.log("Key pair generated successfully!");
      console.log("Public Key (share this):", exportedPublicKeyBase64.slice(0, 64) + "...");

      return exportedPublicKeyBase64;
    } catch (err) {
      console.error("Error generating key pair:", err);
      return null;
    }
  }

  // Encrypt a message with recipient's public key
  async encryptMessage(message, recipientPublicKeyBase64) {
    try {
      // Convert base64 public key back to ArrayBuffer
      const binaryString = atob(recipientPublicKeyBase64);
      const bytes = new Uint8Array(binaryString.length);
      for (let i = 0; i < binaryString.length; i++) {
        bytes[i] = binaryString.charCodeAt(i);
      }

      // Import the recipient's public key
      const recipientPublicKey = await window.crypto.subtle.importKey(
        "spki",
        bytes.buffer,
        {
          name: "RSA-OAEP",
          hash: "SHA-256",
        },
        false,
        ["encrypt"]
      );

      // Encode the message
      const encoder = new TextEncoder();
      const encodedMessage = encoder.encode(message);

      // Encrypt the message
      const encryptedData = await window.crypto.subtle.encrypt(
        {
          name: "RSA-OAEP"
        },
        recipientPublicKey,
        encodedMessage
      );

      // Convert encrypted data to base64 for transmission
      const encryptedDataBase64 = btoa(
        String.fromCharCode(...new Uint8Array(encryptedData))
      );

      console.log("Message encrypted successfully!");
      return encryptedDataBase64;
    } catch (err) {
      console.error("Error encrypting message:", err);
      return null;
    }
  }

  // Decrypt a message with your private key
  async decryptMessage(encryptedMessageBase64) {
    try {
      if (!this.privateKey) {
        throw new Error("Private key not available. Generate a key pair first.");
      }

      // Convert base64 encrypted message back to ArrayBuffer
      const binaryString = atob(encryptedMessageBase64);
      const bytes = new Uint8Array(binaryString.length);
      for (let i = 0; i < binaryString.length; i++) {
        bytes[i] = binaryString.charCodeAt(i);
      }

      // Decrypt the message
      const decryptedData = await window.crypto.subtle.decrypt(
        {
          name: "RSA-OAEP"
        },
        this.privateKey,
        bytes.buffer
      );

      // Decode the decrypted data to text
      const decoder = new TextDecoder();
      const decryptedMessage = decoder.decode(decryptedData);

      console.log("Message decrypted successfully!");
      return decryptedMessage;
    } catch (err) {
      console.error("Error decrypting message:", err);
      return null;
    }
  }
}

// Demo usage
async function demo() {
  console.log("Initializing Secure Messenger...");
  const alice = new SecureMessenger();
  const bob = new SecureMessenger();

  console.log("Generating Alice's keys...");
  const alicePublicKey = await alice.generateKeyPair();

  console.log("Generating Bob's keys...");
  const bobPublicKey = await bob.generateKeyPair();

  const message = "This is a top secret message that only Bob should be able to read!";
  console.log("Alice wants to send:", message);

  console.log("Alice encrypting message with Bob's public key...");
  const encryptedMessage = await alice.encryptMessage(message, bobPublicKey);

  console.log("Encrypted message:", encryptedMessage.slice(0, 64) + "...");

  console.log("Bob decrypting message with his private key...");
  const decryptedMessage = await bob.decryptMessage(encryptedMessage);

  console.log("Bob received:", decryptedMessage);
}